Mike Auty
ce2b83fc34
Add in support for sizing LF_ARGLISTs. Fixes issue #99 .
2019-10-23 00:09:45 +01:00
atcuno
2cad54ea6b
Windows - prevent LIST_ENTRY enumeration code from returning objects on invalid/not mapped pages
2019-10-17 10:27:14 -04:00
Mike Auty
2229c50de8
Remove executable bit from data files.
2019-10-13 10:09:10 +01:00
Mike Auty
3b656e337a
Update windows extensions to ensure they're documented.
2019-10-02 20:25:54 +01:00
Mike Auty
ba14e10d00
pdbconv: Ensure voids do not have a size
...
This partially reverts e17427b9a0
2019-09-29 15:36:26 +01:00
Andrew Case and ikelos
a4a918ea58
Suggested changes from ikelos
2019-09-27 20:50:21 +01:00
Andrew Case and ikelos
bf29e23e1c
add updated mac ifconfig support
2019-09-27 20:50:21 +01:00
Mike Auty
c00b820f74
Fix up recent Mac PagedInvalidAddress additions.
2019-09-27 11:21:49 +01:00
Mike Auty
153b3b7d39
Make sure we catch the most general exception for what we mean.
2019-09-27 11:19:53 +01:00
Andrew Case
eeb04655e6
Mac - smear protection in network address enumeration
2019-09-26 22:08:47 -05:00
Mike Auty
2acdc3e060
Fix up PADDING_INFO for very specific versions of windows.
2019-09-26 13:35:23 +01:00
Mike Auty
e0b9d72c84
Update the license URL and LICENSE.txt
2019-09-25 21:44:05 +01:00
Mike Auty
ee008cb76b
Make sure we accurately check the PADDING_INFO presence.
2019-09-25 21:32:53 +01:00
Mike Auty
2252876375
Correct the PADDING_INFO handling.
2019-09-25 21:32:53 +01:00
Mike Auty
5a8946da83
Shift the InfoMask stuff into the top-down approach.
2019-09-25 21:32:53 +01:00
Mike Auty
b0559656fc
Update the header offsets for the InfoMask.
2019-09-25 21:32:53 +01:00
Mike Auty
6a3a6cdb3c
Add this as more of an example of how to cache.
...
In a volatility object, we can use our own internal _vol variable to
expose values externally, or just for us to cache. It will override
preexisting values though, so when used as a cache, best to make its key
long and unique as possible.
2019-09-25 21:32:53 +01:00
Mike Auty
0fd9bf2dbb
Try to shave some time from the poolscanner by Infomask checking.
2019-09-25 21:32:53 +01:00
Mike Auty
37cb541013
Change the layer naming convention to include the underscores when necessary.
2019-09-25 19:38:39 +01:00
Mike Auty
926288a7ac
Ensure process layer name contains the process ID.
2019-09-25 01:15:58 +01:00
Mike Auty
72567e1c50
Yapf-0.28.0 rerun across the whole codebase.
2019-09-21 21:08:23 +01:00
Mike Auty
7efe19224e
Make several small typing information fixes.
2019-09-17 18:01:11 +01:00
Mike Auty
76a1bb972c
Restore the mac queue_event class override.
...
For some reason, this went missing in commit
a3caf39097
2019-09-16 12:04:50 +01:00
Michael Ligh and ikelos
e71b72b3a7
add the windows callbacks plugin
2019-09-08 16:08:48 +01:00
Mike Auty
e922cef316
Improve docstrings for all plugins, and reformat all docstrings.
2019-09-07 22:59:54 +01:00
Mike Auty
0cb5ca995c
Correctly fix the intermediate file format versions.
2019-08-31 14:24:22 +01:00
Mike Auty
c47ead41b1
Move to the SemVer versioning scheme.
2019-08-31 13:03:51 +01:00
Mike Auty
a3caf39097
Use a mapping to determine kind to class.
2019-08-31 12:57:53 +01:00
Andrew Case and ikelos
07ece011a3
Add mac_tasks
2019-08-27 23:28:51 +01:00
Mike Auty
9cde94bceb
Change the license blurb on all files.
2019-08-27 23:11:00 +01:00
Mike Auty
42b2fb120a
Swap TranslationLayerInterface decendents over to LinearMappedLayers
2019-08-27 21:09:13 +01:00
Mike Auty
95f38aaf5d
Fix up whitespace errors.
2019-08-18 01:22:10 +01:00
Mike Auty
c66f7ff3fd
Add a little extra documentation and fix a typo.
2019-08-18 01:20:56 +01:00
Mike Auty
6000d6c322
Update documentation around the Intermediary Symbol Format.
2019-08-17 23:22:04 +01:00
Mike Auty
be27aab8ae
Refactor symbol to object_type (so it doesn't shadow builtin type).
2019-08-14 20:50:42 +01:00
Mike Auty
18283ab410
Move to an object_from_symbol model
...
Note: creation of enumerations can be done using Context.object, which
should allow reference of enumeration members by normal type objects.
If it turns out enumerations are never referenced from types, we can
easily remove the try/except in the Module.object method.
2019-08-14 20:50:42 +01:00
Mike Auty
5362e2094e
Initial attempt at cleaning up the API
...
Context.object accepts a template or a string name (and now a type
flag). Module.object only accepts a string (because a template already
has most of the stuff built in and might as well be passed to the
Context.object constructor).
The gotcha here is the absolute flag, which must now be set
appropriately in all cases *except* where the module is constructed
with an offset of 0 (whereby it will have no impact).
2019-08-14 20:50:42 +01:00
Dave Lassalle and ikelos
0e22eea58d
improved exception handling in registry and printkey
2019-08-13 20:37:46 +01:00
Mike Auty
196da74fdb
Fix up a manual typo (and remove trailing spaces).
2019-08-11 17:16:57 +01:00
Mike Auty
a412d3ef2f
Guard against list size returns.
2019-08-08 20:30:33 +01:00
Mike Auty
1120854350
Ensure we descend LF_MODIFIERs when finding forward referenced array sizes.
2019-08-08 17:15:25 +01:00
Mike Auty
f0a13c902e
Make changes based on the view (mostly name clarification).
2019-07-30 22:14:19 +01:00
Mike Auty
f9e22d02de
Further typing discrepancy fixes.
2019-07-30 22:14:19 +01:00
Mike Auty
282ddc2f07
Fix up more little math typos and try to clarify what counter is where.
2019-07-30 22:14:19 +01:00
Mike Auty
f3d7de4558
Fix up consumption of padding.
2019-07-30 22:14:19 +01:00
Mike Auty
0302f4b96a
Change calculations to not alter original values for clarity.
2019-07-30 22:14:19 +01:00
Mike Auty
bd2e948d9e
Fix up size for Unions but also ensure total sizes aren't used in calculations.
2019-07-30 22:14:19 +01:00
Mike Auty
6bcb23ea87
Consumed length of enums and FieldLists was slightly off.
2019-07-30 22:14:19 +01:00
Mike Auty
7a0b71f7ae
Fix an issue we hit 1 in 1000 times.
...
Turns out, that because the name consumption is fairly lax (often lots
of excess space after the name, etc) we were reading 2 too many bytes
(because we weren't taken the length of the leaf off the available
length). This would error when it so happened that a structure was at
the end of the type list and we'd read past the end of the tpi stream.
2019-07-30 22:14:19 +01:00
Mike Auty
848fe7391a
Add in further pointer fixes.
2019-07-30 22:14:19 +01:00
Mike Auty